summaryrefslogtreecommitdiffstats
path: root/toolkit/identity/Identity.jsm
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /toolkit/identity/Identity.jsm
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'toolkit/identity/Identity.jsm')
-rw-r--r--toolkit/identity/Identity.jsm309
1 files changed, 309 insertions, 0 deletions
diff --git a/toolkit/identity/Identity.jsm b/toolkit/identity/Identity.jsm
new file mode 100644
index 000000000..a27b7c93d
--- /dev/null
+++ b/toolkit/identity/Identity.jsm
@@ -0,0 +1,309 @@
+/* -*- js-indent-level: 2; indent-tabs-mode: nil -*- */
+/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["IdentityService"];
+
+const Cu = Components.utils;
+const Ci = Components.interfaces;
+const Cc = Components.classes;
+const Cr = Components.results;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/identity/LogUtils.jsm");
+Cu.import("resource://gre/modules/identity/IdentityStore.jsm");
+Cu.import("resource://gre/modules/identity/RelyingParty.jsm");
+Cu.import("resource://gre/modules/identity/IdentityProvider.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this,
+ "jwcrypto",
+ "resource://gre/modules/identity/jwcrypto.jsm");
+
+function log(...aMessageArgs) {
+ Logger.log.apply(Logger, ["core"].concat(aMessageArgs));
+}
+function reportError(...aMessageArgs) {
+ Logger.reportError.apply(Logger, ["core"].concat(aMessageArgs));
+}
+
+function IDService() {
+ Services.obs.addObserver(this, "quit-application-granted", false);
+ Services.obs.addObserver(this, "identity-auth-complete", false);
+
+ this._store = IdentityStore;
+ this.RP = RelyingParty;
+ this.IDP = IdentityProvider;
+}
+
+IDService.prototype = {
+ QueryInterface: XPCOMUtils.generateQI([Ci.nsISupports, Ci.nsIObserver]),
+
+ observe: function observe(aSubject, aTopic, aData) {
+ switch (aTopic) {
+ case "quit-application-granted":
+ Services.obs.removeObserver(this, "quit-application-granted");
+ this.shutdown();
+ break;
+ case "identity-auth-complete":
+ if (!aSubject || !aSubject.wrappedJSObject)
+ break;
+ let subject = aSubject.wrappedJSObject;
+ log("Auth complete:", aSubject.wrappedJSObject);
+ // We have authenticated in order to provision an identity.
+ // So try again.
+ this.selectIdentity(subject.rpId, subject.identity);
+ break;
+ }
+ },
+
+ reset: function reset() {
+ // Explicitly call reset() on our RP and IDP classes.
+ // This is here to make testing easier. When the
+ // quit-application-granted signal is emitted, reset() will be
+ // called here, on RP, on IDP, and on the store. So you don't
+ // need to use this :)
+ this._store.reset();
+ this.RP.reset();
+ this.IDP.reset();
+ },
+
+ shutdown: function shutdown() {
+ log("shutdown");
+ Services.obs.removeObserver(this, "identity-auth-complete");
+ // try to prevent abort/crash during shutdown of mochitest-browser2...
+ try {
+ Services.obs.removeObserver(this, "quit-application-granted");
+ } catch (e) {}
+ },
+
+ /**
+ * Parse an email into username and domain if it is valid, else return null
+ */
+ parseEmail: function parseEmail(email) {
+ var match = email.match(/^([^@]+)@([^@^/]+.[a-z]+)$/);
+ if (match) {
+ return {
+ username: match[1],
+ domain: match[2]
+ };
+ }
+ return null;
+ },
+
+ /**
+ * The UX wants to add a new identity
+ * often followed by selectIdentity()
+ *
+ * @param aIdentity
+ * (string) the email chosen for login
+ */
+ addIdentity: function addIdentity(aIdentity) {
+ if (this._store.fetchIdentity(aIdentity) === null) {
+ this._store.addIdentity(aIdentity, null, null);
+ }
+ },
+
+ /**
+ * The UX comes back and calls selectIdentity once the user has picked
+ * an identity.
+ *
+ * @param aRPId
+ * (integer) the id of the doc object obtained in .watch() and
+ * passed to the UX component.
+ *
+ * @param aIdentity
+ * (string) the email chosen for login
+ */
+ selectIdentity: function selectIdentity(aRPId, aIdentity) {
+ log("selectIdentity: RP id:", aRPId, "identity:", aIdentity);
+
+ // Get the RP that was stored when watch() was invoked.
+ let rp = this.RP._rpFlows[aRPId];
+ if (!rp) {
+ reportError("selectIdentity", "Invalid RP id: ", aRPId);
+ return;
+ }
+
+ // It's possible that we are in the process of provisioning an
+ // identity.
+ let provId = rp.provId;
+
+ let rpLoginOptions = {
+ loggedInUser: aIdentity,
+ origin: rp.origin
+ };
+ log("selectIdentity: provId:", provId, "origin:", rp.origin);
+
+ // Once we have a cert, and once the user is authenticated with the
+ // IdP, we can generate an assertion and deliver it to the doc.
+ let self = this;
+ this.RP._generateAssertion(rp.origin, aIdentity, function hadReadyAssertion(err, assertion) {
+ if (!err && assertion) {
+ self.RP._doLogin(rp, rpLoginOptions, assertion);
+ return;
+
+ }
+ // Need to provision an identity first. Begin by discovering
+ // the user's IdP.
+ self._discoverIdentityProvider(aIdentity, function gotIDP(err, idpParams) {
+ if (err) {
+ rp.doError(err);
+ return;
+ }
+
+ // The idpParams tell us where to go to provision and authenticate
+ // the identity.
+ self.IDP._provisionIdentity(aIdentity, idpParams, provId, function gotID(err, aProvId) {
+
+ // Provision identity may have created a new provision flow
+ // for us. To make it easier to relate provision flows with
+ // RP callers, we cross index the two here.
+ rp.provId = aProvId;
+ self.IDP._provisionFlows[aProvId].rpId = aRPId;
+
+ // At this point, we already have a cert. If the user is also
+ // already authenticated with the IdP, then we can try again
+ // to generate an assertion and login.
+ if (err) {
+ // We are not authenticated. If we have already tried to
+ // authenticate and failed, then this is a "hard fail" and
+ // we give up. Otherwise we try to authenticate with the
+ // IdP.
+
+ if (self.IDP._provisionFlows[aProvId].didAuthentication) {
+ self.IDP._cleanUpProvisionFlow(aProvId);
+ self.RP._cleanUpProvisionFlow(aRPId, aProvId);
+ log("ERROR: selectIdentity: authentication hard fail");
+ rp.doError("Authentication fail.");
+ return;
+ }
+ // Try to authenticate with the IdP. Note that we do
+ // not clean up the provision flow here. We will continue
+ // to use it.
+ self.IDP._doAuthentication(aProvId, idpParams);
+ return;
+ }
+
+ // Provisioning flows end when a certificate has been registered.
+ // Thus IdentityProvider's registerCertificate() cleans up the
+ // current provisioning flow. We only do this here on error.
+ self.RP._generateAssertion(rp.origin, aIdentity, function gotAssertion(err, assertion) {
+ if (err) {
+ rp.doError(err);
+ return;
+ }
+ self.RP._doLogin(rp, rpLoginOptions, assertion);
+ self.RP._cleanUpProvisionFlow(aRPId, aProvId);
+ return;
+ });
+ });
+ });
+ });
+ },
+
+ // methods for chrome and add-ons
+
+ /**
+ * Discover the IdP for an identity
+ *
+ * @param aIdentity
+ * (string) the email we're logging in with
+ *
+ * @param aCallback
+ * (function) callback to invoke on completion
+ * with first-positional parameter the error.
+ */
+ _discoverIdentityProvider: function _discoverIdentityProvider(aIdentity, aCallback) {
+ // XXX bug 767610 - validate email address call
+ // When that is available, we can remove this custom parser
+ var parsedEmail = this.parseEmail(aIdentity);
+ if (parsedEmail === null) {
+ aCallback("Could not parse email: " + aIdentity);
+ return;
+ }
+ log("_discoverIdentityProvider: identity:", aIdentity, "domain:", parsedEmail.domain);
+
+ this._fetchWellKnownFile(parsedEmail.domain, function fetchedWellKnown(err, idpParams) {
+ // idpParams includes the pk, authorization url, and
+ // provisioning url.
+
+ // XXX bug 769861 follow any authority delegations
+ // if no well-known at any point in the delegation
+ // fall back to browserid.org as IdP
+ return aCallback(err, idpParams);
+ });
+ },
+
+ /**
+ * Fetch the well-known file from the domain.
+ *
+ * @param aDomain
+ *
+ * @param aScheme
+ * (string) (optional) Protocol to use. Default is https.
+ * This is necessary because we are unable to test
+ * https.
+ *
+ * @param aCallback
+ *
+ */
+ _fetchWellKnownFile: function _fetchWellKnownFile(aDomain, aCallback, aScheme='https') {
+ // XXX bug 769854 make tests https and remove aScheme option
+ let url = aScheme + '://' + aDomain + "/.well-known/browserid";
+ log("_fetchWellKnownFile:", url);
+
+ // this appears to be a more successful way to get at xmlhttprequest (which supposedly will close with a window
+ let req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
+ .createInstance(Ci.nsIXMLHttpRequest);
+
+ // XXX bug 769865 gracefully handle being off-line
+ // XXX bug 769866 decide on how to handle redirects
+ req.open("GET", url, true);
+ req.responseType = "json";
+ req.mozBackgroundRequest = true;
+ req.onload = function _fetchWellKnownFile_onload() {
+ if (req.status < 200 || req.status >= 400) {
+ log("_fetchWellKnownFile", url, ": server returned status:", req.status);
+ return aCallback("Error");
+ }
+ try {
+ let idpParams = req.response;
+
+ // Verify that the IdP returned a valid configuration
+ if (! (idpParams.provisioning &&
+ idpParams.authentication &&
+ idpParams['public-key'])) {
+ let errStr= "Invalid well-known file from: " + aDomain;
+ log("_fetchWellKnownFile:", errStr);
+ return aCallback(errStr);
+ }
+
+ let callbackObj = {
+ domain: aDomain,
+ idpParams: idpParams,
+ };
+ log("_fetchWellKnownFile result: ", callbackObj);
+ // Yay. Valid IdP configuration for the domain.
+ return aCallback(null, callbackObj);
+
+ } catch (err) {
+ reportError("_fetchWellKnownFile", "Bad configuration from", aDomain, err);
+ return aCallback(err.toString());
+ }
+ };
+ req.onerror = function _fetchWellKnownFile_onerror() {
+ log("_fetchWellKnownFile", "ERROR:", req.status, req.statusText);
+ log("ERROR: _fetchWellKnownFile:", err);
+ return aCallback("Error");
+ };
+ req.send(null);
+ },
+
+};
+
+this.IdentityService = new IDService();